Wazuh 4.14.6 — two cluster-protocol paths to root that bypass the CVE-2026-25770 fix, a DAPI deserialization RCE, and a pre-auth stack overflow on the enrollment port
Wazuh — the open-source SIEM and XDR platform many public-sector SOCs run themselves — shipped 4.14.6 on 2026-08-06 and 2026-08-07 with ten CVEs, each disclosed as its own advisory, and BSI CERT-Bund independently cross-listed the same identifiers for the same release (BSI CERT-Bund, 2026-08-06). Four carry the operational weight, and two of them matter beyond their scores because they defeat a fix the project already shipped.
CVE-2026-49441 and CVE-2026-48024 are both arbitrary-file-write-to-root primitives in the cluster protocol's master-side file-receive path, and both reach it through sibling code paths that the _ALLOWED_PREFIXES hardening added for CVE-2026-25770 in 4.14.3 does not cover — one through the non-merged branch's unchecked mapping of a peer-supplied key to a destination path, the other through peer-controlled path traversal in the merged-file header line (Wazuh, 2026-08-07, Wazuh, 2026-08-06). Either lets a peer holding the shared Fernet key overwrite ossec.conf and reach root by way of the next wazuh-logcollector reload. CVE-2026-44901 is a deserialization flaw in the distributed API's response-merging function: a compromised worker sets sort_casting to a builtin name that is never allowlisted, and the master resolves and calls it as root — but only when a REST request fans out across two or more nodes, which is the precondition worth remembering during triage (Wazuh, 2026-08-06).
CVE-2026-45798 is the one reachable by anyone. A fixed-size copy in the version-comparison helper never NUL-terminates a maximum-length input, and the out-of-bounds scans that follow crash the daemon; the function sits behind the V: field of an enrollment message to wazuh-authd on TCP/1515, and Wazuh states plainly that the shipped defaults require no credential to get there (Wazuh, 2026-08-06). Every flaw here is researcher-reported with no exploitation claimed by any party.
Detection, telemetry class first. The cluster wire protocol is rarely visible to conventional network inspection, so the durable anchor for the file-write pair is file-integrity state on ossec.conf — an unexpected content or timestamp change followed by a wazuh-logcollector restart is the sequence, not either event alone. For the distributed-API flaw, process-creation telemetry showing the manager's own API or cluster daemon as the parent of a shell or interpreter is anomalous on a healthy cluster, and the necessary condition is a REST request naming more than one node. For the enrollment overflow, repeated short-lived connections to the enrollment port followed by daemon restarts is the crash signature. Triage: legitimate cluster synchronisation writes constantly into each peer's own queue subtree, so file writes by the manager are normal — the discriminator is a write landing outside that subtree, in the configuration directory.
A cluster peer holding the shared Fernet key can write arbitrary files anywhere the wazuh user has write access on the master, including /var/ossec/etc/ossec.conf.
The function is reachable pre-authentication via the V: field of an enrollment message sent to wazuh-authd on TCP/1515 over anonymous SSL (default configuration: use_password=no, ssl_verify_host=no).
A compromised worker can set sort_casting=["exec"] and embed a Python payload inside affected_items. When the master merges responses from two or more nodes, it calls : exec(<payload>) as root.
Defender actions
- Upgrade every Wazuh manager to 4.14.6 — the pre-auth overflow in wazuh-authd needs no credential and no cluster membership, so an internet-reachable or untrusted-segment enrollment port on TCP/1515 is exposed under the shipped anonymous-SSL default.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Lateral Movement TA0008
T1210Exploitation of Remote Services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.